CVE-2022-4510
HIGH 7.8EPSS 22.0%
A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.This issue affects binwalk from 2.1.2b through 2.3.3 included.
- CVSS v3.1
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 22.01% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2023-01-25
- Updated
- 2025-12-16
Proof-of-concept exploits (5)
- ReFirmLabs/binwalk/pull/617
- Kalagious/BadPfs1★ · 2023-07-11
- Kalagious/BadPfs-CVE-2022-45101★ · 2023-07-11
- adhikara13/CVE-2022-4510-WalkingPath14★ · 2023-06-27
- electr0sm0g/CVE-2022-45109★ · 2023-02-06